Initialize the GatewayAPI upgradeable controller with required imports and constants.

Set up predicates and watches for ConfigMap and CRD updates.
Implement the operator and admingate
Add e2e testing to testadminupgrade

Author: Ali Syed

pkg/operator/controller/gatewayapi-upgradeable/controller.go

@@ -0,0 +1,166 @@
+package gatewayapi_upgradeable
+
+import (
+	"context"
+	"fmt"
+
+	logf "github.com/openshift/cluster-ingress-operator/pkg/log"
+	operatorcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
+
+	corev1 "k8s.io/api/core/v1"
+
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+	gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	controllerName     = "gatewayapi_upgradeable_controller"
+	GatewayAPIAdminKey = "ack-gateway-api-management"
+	GatewayAPIAdminMsg = "This message was generated due to the presence of the Gateway API CRDs in the cluster. Going forward OCP will fully manage the lifecycle of these CRDs and we strongly advise against any external entity attempting to manage them, as this will be blocked and result in failure. Only the platform itself will support management of these CRDs. Any tampering will cause the cluster to enter a 'Degraded' state. The cluster administrator is responsible for the safety of existing Gateway API implementations. An admin gate will inform the administrator of their responsibilities and prevent upgrades until they acknowledge and accept them. For more information, please refer to the [link to doc here pending]."
+)
+
+var (
+	log = logf.Logger.WithName(controllerName)
+)
+
+// The New function initializes the controller and sets up the watch for the ConfigMap.
+func New(mgr manager.Manager) (controller.Controller, error) {
+	reconciler := &reconciler{
+		client: mgr.GetClient(),
+		cache:  mgr.GetCache(),
+	}
+
+	c, err := controller.New(controllerName, mgr, controller.Options{
+		Reconciler: reconciler,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// A predicate filter to watch for specific changes in the ConfigMap.
+	// Verify that the ConfigMap's name and namespace match the expected values.
+	adminGatePredicate := predicate.NewPredicateFuncs(func(o client.Object) bool {
+		cm := o.(*corev1.ConfigMap)
+		return cm.Name == operatorcontroller.AdminGatesConfigMapName().Name && cm.Namespace == operatorcontroller.AdminGatesConfigMapName().Namespace
+	})
+
+	// Mapping the events to the admin gate ConfigMap.
+	toAdminGateConfigMap := func(_ context.Context, _ client.Object) []reconcile.Request {
+		return []reconcile.Request{{
+			NamespacedName: operatorcontroller.AdminGatesConfigMapName(),
+		}}
+	}
+
+	// Defining the CRD predicate.
+	crdPredicate := predicate.NewPredicateFuncs(func(o client.Object) bool {
+		return o.(*apiextensionsv1.CustomResourceDefinition).Spec.Group == gatewayapiv1.GroupName
+	})
+
+	// Setting up a watch for CRD events.
+	if err := c.Watch(source.Kind[client.Object](mgr.GetCache(), &apiextensionsv1.CustomResourceDefinition{}, handler.EnqueueRequestsFromMapFunc(toAdminGateConfigMap), crdPredicate)); err != nil {
+		return nil, err
+	}
+
+	if err := c.Watch(source.Kind[client.Object](mgr.GetCache(), &corev1.ConfigMap{}, &handler.EnqueueRequestForObject{}, adminGatePredicate)); err != nil {
+		return nil, err
+	}
+
+	return c, nil
+}
+
+// Reconciler struct holds the client and cache attributes.
+type reconciler struct {
+	client client.Client
+	cache  cache.Cache
+}
+
+// Reconcile function implements the logic to check conditions and manage the admin gate.
+func (r *reconciler) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) {
+	log.Info("reconciling", "request", request)
+
+	adminGateConditionExists, err := r.adminGateConditionExists(ctx)
+	if err != nil {
+		return reconcile.Result{}, fmt.Errorf("failed to determine if admin gate condition exists: %v", err)
+	}
+
+	if adminGateConditionExists {
+		if err := r.addAdminGate(ctx); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to add admin gate: %w", err)
+		}
+	} else {
+		if err := r.removeAdminGate(ctx); err != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to remove admin gate: %w", err)
+		}
+	}
+
+	return reconcile.Result{}, nil
+}
+
+// adminGateConditionExists checks if the admin gate condition exists based on both ConfigMap and CRDs.
+func (r *reconciler) adminGateConditionExists(ctx context.Context) (bool, error) {
+	crds := &apiextensionsv1.CustomResourceDefinitionList{}
+	if err := r.client.List(ctx, crds); err != nil {
+		return false, fmt.Errorf("failed to list CRDs: %w", err)
+	}
+
+	for _, crd := range crds.Items {
+		if crd.Spec.Group == gatewayapiv1.GroupName {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// The addAdminGate function is responsible for adding the admin gate to the ConfigMap.
+func (r *reconciler) addAdminGate(ctx context.Context) error {
+	adminGateConfigMap := &corev1.ConfigMap{}
+	if err := r.cache.Get(ctx, operatorcontroller.AdminGatesConfigMapName(), adminGateConfigMap); err != nil {
+		return fmt.Errorf("failed to get configmap %s: %w", operatorcontroller.AdminGatesConfigMapName(), err)
+	}
+
+	if adminGateConfigMap.Data == nil {
+		adminGateConfigMap.Data = map[string]string{}
+	}
+
+	// The function checks if the admin key exists and if it is set to the expected message.
+	if val, ok := adminGateConfigMap.Data[GatewayAPIAdminKey]; ok && val == GatewayAPIAdminMsg {
+		return nil
+	}
+	adminGateConfigMap.Data[GatewayAPIAdminKey] = GatewayAPIAdminMsg
+
+	log.Info("Adding admin gate for Gateway API management")
+	if err := r.client.Update(ctx, adminGateConfigMap); err != nil {
+		return fmt.Errorf("failed to update configmap %s: %w", operatorcontroller.AdminGatesConfigMapName(), err)
+	}
+	return nil
+}
+
+// The removeAdminGate function is responsible for removing the admin gate from the ConfigMap.
+func (r *reconciler) removeAdminGate(ctx context.Context) error {
+	adminGateConfigMap := &corev1.ConfigMap{}
+	if err := r.cache.Get(ctx, operatorcontroller.AdminGatesConfigMapName(), adminGateConfigMap); err != nil {
+		return fmt.Errorf("failed to get configmap %s: %w", operatorcontroller.AdminGatesConfigMapName(), err)
+	}
+
+	// The function checks if the admin key exists in the ConfigMap.
+	if _, ok := adminGateConfigMap.Data[GatewayAPIAdminKey]; !ok {
+		return nil // Nothing to do if the key doesn't exist
+	}
+
+	log.Info("Removing admin gate for Gateway API management")
+	delete(adminGateConfigMap.Data, GatewayAPIAdminKey)
+	if err := r.client.Update(ctx, adminGateConfigMap); err != nil {
+		return fmt.Errorf("failed to update configmap %s: %w", operatorcontroller.AdminGatesConfigMapName(), err)
+	}
+	return nil
+}

pkg/operator/controller/names.go

@@ -49,6 +49,13 @@ const (
 	RemoteWorkerLabel = "node.openshift.io/remote-worker"
 )
 
+func AdminGatesConfigMapName() types.NamespacedName {
+	return types.NamespacedName{
+		Name:      "admin-gates",
+		Namespace: GlobalMachineSpecifiedConfigNamespace,
+	}
+}
+
 // IngressClusterOperatorName returns the namespaced name of the ClusterOperator
 // resource for the operator.
 func IngressClusterOperatorName() types.NamespacedName {

test/e2e/gatewayapi_upgradeable_test.go

@@ -0,0 +1,94 @@
+//go:build e2e
+// +build e2e
+
+package e2e
+
+import (
+	"context"
+	"k8s.io/client-go/kubernetes"
+	"testing"
+
+	operatorcontroller "github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
+	gatewayapi_upgradeable "github.com/openshift/cluster-ingress-operator/pkg/operator/controller/gatewayapi-upgradeable"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+)
+
+func TestGatewayAPIUpgradeable(t *testing.T) {
+	t.Parallel()
+
+	t.Log("Starting test: Ensure the Gateway API CRDs exist")
+	ensureCRDs(t)
+
+	t.Log("Starting test: Testing if admin gate works properly")
+	testAdminGate(t)
+
+	t.Log("Starting test: Deleting Gateway API CRDs")
+	deleteCRDs(t)
+
+	t.Log("Starting test: Testing if admin gate works properly after CRDs are deleted")
+	testAdminGate(t)
+
+	// Defer the cleanup of the test gateway.
+	t.Cleanup(func() {
+		t.Log("Starting cleanup: Deleting test gateway")
+		testGateway := gatewayapiv1.Gateway{ObjectMeta: metav1.ObjectMeta{Name: testGatewayName, Namespace: operatorcontroller.DefaultOperandNamespace}}
+		if err := kclient.Delete(context.TODO(), &testGateway); err != nil {
+			if errors.IsNotFound(err) {
+				t.Logf("Gateway %q not found during cleanup", testGateway.Name)
+				return
+			}
+			t.Errorf("failed to delete gateway %q: %v", testGateway.Name, err)
+		} else {
+			t.Logf("Successfully deleted gateway %q", testGateway.Name)
+		}
+	})
+}
+
+func getClient() (*kubernetes.Clientset, error) {
+	kubeConfig, err := config.GetConfig()
+	if err != nil {
+		return nil, err
+	}
+	return kubernetes.NewForConfig(kubeConfig)
+}
+
+func testAdminGate(t *testing.T) {
+	kclient, err := getClient()
+	if err != nil {
+		t.Fatalf("failed to get kube client: %v", err)
+	}
+
+	t.Log("Ensuring CRDs exist")
+	crdsExist := true
+
+	t.Logf("Getting configmap admin-gates in namespace openshift-config-managed")
+	configMap, err := kclient.CoreV1().ConfigMaps("openshift-config-managed").
+		Get(context.TODO(), "admin-gates", metav1.GetOptions{})
+	if err != nil {
+		t.Errorf("failed to get configmap admin-gates: %v", err)
+		if errors.IsNotFound(err) {
+			t.Logf("ConfigMap 'admin-gates' not found in namespace openshift-config-managed")
+		} else {
+			t.Logf("Error getting ConfigMap: %v", err)
+		}
+		return
+	}
+
+	t.Log("Checking for admin gate key in the configmap")
+	adminGateKeyExists := false
+	if _, ok := configMap.Data[gatewayapi_upgradeable.GatewayAPIAdminKey]; ok {
+		adminGateKeyExists = true
+	}
+
+	t.Logf("CRDs exist: %v, Admin Gate Key exists: %v", crdsExist, adminGateKeyExists)
+
+	if crdsExist && !adminGateKeyExists {
+		t.Errorf("expected admin gate key to exist in configmap, but it does not")
+	} else if !crdsExist && adminGateKeyExists {
+		t.Errorf("expected admin gate key to be removed from configmap, but it still exists")
+	}
+}